Nobody Said I Shouldn't
"My name is Chris and I do systems support for our group. I configure the new computers, set up the network, make sure the servers are operating, and so forth.
I also do all of the database backups. I've always liked computers. After high school, I worked odd jobs to make some money, then I got an associate degree in information technology from our local community college. "Anyway, as I said, I make backup copies of our databases. One weekend, I didn't have much going on, so I copied one of the database backups to a DVD and took it home. I had taken a class on database processing as part of my associate degree, and we used SQL Server (our database management system) in my class.
In fact, I suppose that's part of the reason I got the job. Anyway, it was easy to restore the database on my computer at home, and I did. "Of course, as they'll tell you in your database class, one of the big advantages of database processing is that databases have metadata, or data that describe the content of the database. So, although I didn't know what tables were in our database, I did know how to access the SQL Server metadata.
I just queried a table called sysTables to learn the names of our tables. From there it was easy to find out what columns each table had. "I found tables with data about orders, customers, salespeople, and so forth, and, just to amuse myself, and to see how much of the query language SQL that I could remember, I started playing around with the data. I was curious to know which order entry clerk was the best, so I started querying each clerk's order data, the total number of orders, total order amounts, things like that. It was easy to do and fun. "I know one of the order entry clerks, Jason, pretty well, so I started looking at the data for his orders. I was just curious, and it was very simple SQL.
I was just playing around with the data when I noticed something odd. All of his biggest orders were with one company, Valley Appliances, and even stranger, every one of its orders had a huge discount. I thought, well, maybe that's typical. Out of curiosity, I started looking at data for the other clerks, and very few of them had an order with Valley Appliances. But, when they did, Valley didn't get a big discount. Then I looked at the rest of Jason's orders, and none of them had much in the way of discounts, either. "The next Friday, a bunch of us went out for a beer after work. I happened to see Jason, so I asked him about Valley Appliances and made a joke about the discounts. He asked me what I meant, and then I told him that I'd been looking at the data for fun and that I saw this odd pattern.
He just laughed, said he just ‘did his job,' and then changed the subject. "Well, to make a long story short, when I got to work on Monday morning, my office was cleaned out. There was nothing there except a note telling me to go see my boss. The bottom line was, I was fired. The company also threatened that if I didn't return all of its data, I'd be in court for the next 5 years . . . things like that. I was so mad I didn't even tell them about Jason. Now my problem is that I'm out of a job, and I can't exactly use my last company for a reference."
Discussion Questions
1. Where did Chris go wrong?
2. Do you think it was illegal, unethical, or neither for Chris to take the database home and query the data?
3. Does the company share culpability with Chris?
4. What do you think Chris should have done upon discovering the odd pattern in Jason's orders?
5. What should the company have done before firing Chris?
6. Is it possible that someone other than Jason is involved in the arrangement with Valley Appliances? What should Chris have done in light of that possibility?
7. What should Chris do now?
8. "Metadata make databases easy to use, for both authorized and unauthorized purposes." Explain what organizations should do in light of this fact.